EPExtendedEventMT table

[Hawkmoon]

Hi stevechmiewlisk,

That table belongs to the ENS product, (Exploit prevention and Access prevention events may well be recorded in here).

If you take a look at the table contents you maybe able to identify what rules are being triggered (I'd guess you have a 'hyper active'/noisy' rule(s) populating it.)

The case you have in support should be followed to its conclusion, as any action as aggressive as purge will create holes in any and all reports your business may require.

I'll/I've moved this matter to the ENS forum as they will be better positioned to decide what rules etc are overly active and how to manage them.